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Abstract 

In recent years, ethics has drawn increased interest from information technology and computer 
science practitioners as well as from academicians. This article investigates the issues outlined in the 
PAPA framework in today's environment and explores the possibility that new issues have emerged. 
Findings indicate that the ethicality of property misuse may be viewed differently based on the level of 
personal risk, thereby offering a refinement of the original PAPA property issue. 
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1. INTRODUCTION 

As society becomes increasingly entrenched in 
the digital information era, ethics in computing 
continues to be an important and widely 
discussed issue in both academia and practice. 
In 1986, Mason introduced four broad categories 
of ethical issues for the information age: 
privacy, accuracy, property, and access, 
otherwise known as PAPA (1986). More than 
twenty years later, those four issues are still 
timely and relevant. Mason's discussion centered 
on the personal harm that could occur from the 
unethical use of information and information 
technology (IT) within the framework of PAPA. 
In 1986, Mason could never have predicted that 
the computer would become not only the tool, 
but also the object, of such serious ethical 
transgressions as those that occur in today's 
networked world. However, his PAPA framework 
is still quite germane in studying ethical issues in 


IT. This research attempts to test the issues 
outlined in the PAPA framework in today's 
environment and to explore the possibility that 
new issues have emerged. This test and 
exploration is accomplished through the 
enhancement and validation of a survey 
instrument first introduced by Harris (2000). 

2. BACKGROUND 

Mason's (1986) seminal essay did not 
specifically define the PAPA issues as theoretical 
constructs, but rather launched each as an area 
of discussion and debate. Mason's concern for 
privacy was that an individual should be able to 
decide what personal information to hold 
private, what information to share, and be 
confident that shared information would be kept 
safe. The issue of accuracy focused on 
discussions of who was responsible for the 
accuracy and authenticity of information and 
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what retribution was due to those injured by 
erroneous data. Mason's discussion of property 
addressed intellectual property rights, including 
those not necessarily protected by law. Mason 
also made reference to physical property such as 
the "conduits through which information passes" 
(p. 10). The final issue of the PAPA framework, 
access, dealt with the right or authority to obtain 
information. 

Cadres of research in ethics and IT have been 
published since Mason's visionary essay in 1986. 
Several studies have considered one or a few of 
the PAPA issues, but only one known study 
attempted to measure or validate all four PAPA 
constructs. Using ethical dilemma scenarios, 
Conger, Loch, and Helft (1995) developed a 16 
scenario/51 item instrument and surveyed 79 
graduate business students. The analysis 
produced 12 factors which the authors grouped 
into five clusters. Two of the clusters aligned 
well with Mason's access and privacy issues. A 
third cluster aligned with Mason's property issue, 
but was better defined by the concept of 
ownership. A fourth cluster represented 
"responsibility for accuracy" (p. 25), a different 
perspective from Mason's concern with the 
impact of inaccuracy. A fifth cluster, motivation, 
represented an expansion the PAPA framework. 
While Mason offered a general discussion of 
victimization, Conger et al.'s motivation cluster 
reflected a recognized responsibility for actions 
that affect others. 

More recently, Harris (2000) developed an 
instrument to measure student attitudes toward 
IT-related ethical dilemma scenarios. He found 
some evidence that sensitivity toward IT ethical 
issues increased as academic training increased. 
Harris also found support indicating that females 
may be more sensitive to IT ethical issues 
involving software use. Although it was not 
Harris' intention to measure the validity of PAPA 
constructs, his instrument questions were 
"roughly developed around Mason's PAPA" (p. 
802). 

Twenty years after Mason's ethical issues essay, 
Peslak (2006) surveyed more than 200 
individuals and verified that the four original 
PAPA issues were still viewed as timely and 
important ethical concerns. 

As part of a larger research endeavor, the 
primary objective of the current study was to 
determine if the ethical issues first delineated by 
the PAPA framework were still relevant and if 
other issues have replaced them. An additional 
objective was to explore any current issues that 
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should be added to the PAPA framework. These 
objectives are important to IS educators so that 
ethics education can continue to evolve as the 
issues our students and future IT professionals 
are faced with also evolve. 

3. METHODOLOGY 

As noted by the prior studies, the use of ethical 
dilemmas or situations is an effective method of 
evaluating how students make ethical decisions 
(Cougar, 1989; Loviscky, Trevino, & Jacobs, 
2007). After an extensive review of the 
literature, only the two aforementioned studies 
had used ethical dilemmas related to the PAPA 
issues. The survey instrument designed by 
Harris (2000) was selected as the basis to 
evaluate the ethical decision making of 
information technology students. Harris' survey 
is referred to as the Ethics in Information 
Technology (IT) Survey and was used with the 
author's permission. This instrument was chosen 
because it better reflects current ethical 
dilemmas facing students as well as 
professionals in the field. 

Examples of the ethical dilemmas include such 
scenarios as using company email to send spam, 
copying software from work for personal use, 
and giving a non-student friend login access to 
university computing resources. The instrument 
has been enhanced from Harris' original and the 
detailed wording of the scenarios was published 
in an earlier study (Woodward, Davis, & Hodis, 
2007). 

The final survey contained 22 scenarios, some 
with multiple items for a total of 29 items. In the 
scenarios, an individual is presented with a 
situation and required to make a choice for a 
particular action. The students were asked to 
evaluate the individuals' responses to the 
situations presented. In some scenarios, 
respondents evaluated two party's actions, for 
example, the manager and the employee. 
Students were to mark an answer indicating 
whether the individual's action was ethical, 
acceptable, questionable, unethical, or computer 
crime. The categories are described as: 

• Ethical - There is no question that the action is 
correct in every sense of the word. Ethically, 
morally, and legally, this is proper behavior. 

• Acceptable - The action is acceptable to you, 
although you may have some doubts due to 
morals or other beliefs. 

• Questionable - There is some question as to 
the moral or ethical aspects of the action. The 
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action truly belongs in the "gray area" of human 
behavior. 

• Unethical - The action is contrary to moral and 
ethical standards, although not a crime. This is 
truly unacceptable behavior. 

• Computer Crime - The action is unethical and 
illegal, and the person responsible should be 
prosecuted for a criminal act (Harris, 2000). 

IT students are an appropriate population since 
they are routinely faced with situations where 
they may be forced to make ethical decisions. 
Moreover, students have been shown to 
recognize PAPA issues as important when 
compared to professionals and others (Peslak, 
2006). Additionally, younger populations, both 
students and younger professionals, have been 
shown to be more accepting of certain unethical 
behaviors such as the illegal copying and use of 
software (Kini, Ramakrishna, & Vijayaraman, 
2004; Kruger, 2003; Peace, Galletta, & Thong, 
2003). For these reasons, we selected 
undergraduate IT students for this study. 

The survey was administered to undergraduate 
IT students in universities in four countries. 
Because ethics in IT is a worldwide issue, the 
inclusion of multiple cultures should contribute 
to the validity of any outcomes of the study. The 
comparative responses among the countries are 
being analyzed as part of the larger study and 
hence are not specifically addressed herein. 

The survey was completed by 373 IT students: 
198 from an American Midwest region 
university, 44 from a main British university, 51 
from a main German university and 80 from a 
main Italian university. Of the total sample, 
20% were female students (N=71) and 80% 
were male students (N=284). The average age 
of the respondents was 23.5. The total final valid 
sample was 355. The students participated 
voluntarily and were ensured of the 
confidentiality of their responses and all surveys 
were completed anonymously. The same 
instructor administered the surveys in all 
locations. 

Data Analysis 

To determine if an underlying structure of PAPA 
related factors exists in the survey items, 
exploratory principal component factor analysis 
was conducted. Because there was an apriori 
assumption that any resulting factors could likely 
be related, all dealing with ethical issues in IT, 
Promax, an oblique rotation method, was 
selected. 
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The subject to item ratio in this study was 
approximately 12:1, greater than the generally 
accepted 10:1 ratio for exploratory factor 
analysis (Costello & Osborne, 2005). The data 
were screened for multicollinearity concerns and 
review of the correlation matrix combined with 
an R-matrix determinant equal to .001 assured 
that multicollinearity was not a concern in the 
data. The KMO statistic for the data was .823 
and Bartlett's test was highly significant, 
indicating factor analysis was appropriate for the 
data (Field, 2000). 

Proceeding with a Promax rotation, a cutoff 
value of .30 was utilized as a minimum 
acceptable item loading (Hair Jr., Tatham, 
Anderson, Black, & Babin, 2006). The initial 
solution produced nine factors based on Kaiser's 
criterion of retaining factors with eigenvalues 
greater than one, explaining 60.22% of the 
variance in the data. However, nine factors led 
to interpretation difficulties because several 
factors displayed item cross-loadings and 
several contained fewer than three items. These 
conditions do not contribute to a "clean" factor 
structure (Costello & Osborne, 2005). 
Furthermore, the Kaiser criterion is considered 
one of the least accurate methods for selecting 
the appropriate number of factors (Velicer & 
Jackson, 1990). Therefore, we proceeded to 
interpretation of the scree plot. The scree test 
indicated an obvious break point in the data 
after four factors. To ensure proper selection, we 
analyzed the data creating three through nine 
factors, and the four factor solution produced 
the cleanest factor structure, even though the 
explained variance was reduced to 41%. 
Therefore, data analysis proceeded with a four 
factor solution. The resulting factor structure is 
displayed in Appendix 1. 

4. RESULTS 

Factor 1 contained 11 items with scores ranging 
from .816 to .333. The reliability of the factor 
was measured by Cronbach's alpha at .80, an 
acceptable level (Nunnally, 1978). Factor 2 
contained 8 items with loadings ranging from 
.782 to .351. The Cronbach's alpha score was 
.793, also an acceptable level of reliability 
(Nunnally, 1978). Factor 3 consisted of 3 items 
with loadings in the range of .768 to .339. The 
reliability of this factor was weak at .430. Factor 
4 contained five items ranging in loadings from 
.808 to .313. The Cronbach's alpha measure of 
reliability for this factor was also weak at .501. 
Although the fourth factor contained a variable, 
email checking, that loaded fairly evenly across 
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three factors, the reliability analysis indicated 
that eliminating it from Factor 4 would lower the 
scale score. Hence, the variable was retained in 
the analysis. The items bank employee and 
inaccurate programming did not load onto any of 
the four factors. 

Factor Interpretation 

Low Risk Property Misuse: The 11 items in the 
first factor are related to the misuse of property, 
such as software and other computing 
resources. For example, making copies of 
software or using a company computer for 
personal business were issues in this factor. This 
category aligns with Mason's (1986) property 
issue and Conger et al.'s (1995) ownership 
category of ethical issues. 

Interestingly, in the responses, the majority of 
students found these issues to range from 
questionable to unethical, but relatively few 
rated the actions as criminal even though 
obvious copyright infringement occurred in some 
of the scenarios. This factor may also represent 
a motivational aspect of property misuse, similar 
to the personal motivation factor that Conger et 
al. (1995) discovered. A common theme in the 
scenarios in this factor is the personal gain from 
the action and somewhat private nature of the 
behavior. It is possible that this factor 
represents the misuse of property where the risk 
of retribution is considered quite low. For these 
reasons, we labeled this factor Low Risk Property 
Misuse. 

High Risk Property Misuse: The second factor 
consisted of eight items, most also reflecting 
issues of unethical or criminal behavior toward 
property. Some issues in this factor represented 
criminal trespass of property, such as the use of 
trademarks and patents. Other issues 
represented unethical or criminal actions, such 
as manipulating data or not reporting a software 
error. 

A distinctive difference between the Low Risk 
Property Misuse factor and this factor was found 
in the student responses. While in the Low Risk 
Property Misuse factor, most respondents felt 
the issues were questionable or unethical, in this 
factor, most respondents felt the issues were at 
minimum unethical and at most criminal. 

The items differed from the Low Risk Property 
Misuse factor in terms of possible motivators. 
Most of the items in this factor are related to 
actions on behalf of an organization, albeit some 
personally owned organizations, rather than 
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action for individual gain. The scenarios that fell 
into this factor also appear to carry more risk 
than those in the previous factor. For example, 
the illegal use of a trademark on a website is 
quite a transparent violation that could easily be 
identified. Similarly, patent infringement is a 
risky action that might be discovered and 
litigated. Because the actions in this factor 
appear similar in their level of perceived risk as 
opposed to those in the previous factor, we 
labeled this factor High Risk Property Misuse. 

Personal Responsibility: The third factor was 
rather unstable with a reliability score of .430 
and should thus be interpreted cautiously. The 
issues in this factor seemed to reflect 
respondents' difficulty in determining true harm. 
For example, sending political spam from a 
company computer when there was no specific 
policy against it, or spreading a virus for the 
sake of experimentation were not clear cut 
ethical issues. The third item placed the 
actionable party once removed from the 
unethical behavior; she would create a website 
that would be used by the customer for 
unethical activity. These issues were intended to 
represent the responsibility of one's actions. Our 
Personal Responsibility factor most closely aligns 
with Conger et al.'s (1995) personal 
accountability category. Most student 
respondents found these three issues to be at 
best questionable and at worst unethical. 

Privacy: T he fourth factor consisted of five items 
all representing various facets of privacy. This 
factor displayed a weak reliability score at .501 
and should be interpreted with caution. 
Examples of the scenarios include firing an 
employee for inappropriate web browsing and 
management monitoring of employee email. 
Labeled Privacy, this factor aligned with Mason's 
privacy issue and with Conger et al.'s (1995) 
category of personal privacy. The student 
responses were not as clearly categorized as in 
the other factors. The respondents felt that the 
actions of the managers fairly evenly ranged 
from ethical to unethical even when workplace 
policies were lenient or absent. They also 
reported that the employee's actions were 
unethical even considering a fairly lenient usage 
policy. 

5. DISCUSSION 

Keeping abreast of ethical dilemmas faced by 
our future IT professionals is of critical concern 
to IS educators. As technology rapidly advances, 
current and future professionals are faced with 
an ever-changing array of ethical situations. It is 
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the duty of IS academia to continually evolve 
the IS ethics curriculum to keep pace with such 
changes. Because variations of the PAPA issues 
have stood the test of time, we attempted to 
validate and potentially update the PAPA 
framework as a guiding tool for both IS 
academia and IS professionals. 

Mason's (1986) ethical issues of concern for the 
information age were property, accuracy, 
privacy, and access. Conger and her colleagues 
(1995) offered a more complex view of 
computer related ethical issues and categorized 
them into five subject areas: ownership, access, 
motivation, responsibility, and privacy. In our 
analysis, we derived four distinct factors, 
although two were related to property misuse. 
Our factors were low risk property misuse, high 
risk property misuse, personal responsibility, 
and privacy. 

While both Mason (1986) and Conger et al. 
(1995) identified property/ownership as an 
ethical issue of concern, our results break down 
the issue into perceived risk levels associated 
with the maltreatment of property. Even though 
misuse is technically misuse, our results appear 
to delineate levels of "acceptable" property 
misuse at least within a limited cross-cultural 
student population. By uncovering this more 
precise view of property misuse, we believe we 
have expanded upon the earlier frameworks. 

Our personal responsibility factor seemed to 
reflect the respondents' indifference toward their 
accountable actions when there was little policy 
or guidance in place, or when they were once 
removed from the final result of their actions. 
Mason's (1986) PAPA framework did not address 
this issue specifically. Though not a perfect 
match, our factor most closely aligns with 
Conger et al.'s (1995) personal accountability 
factor within their responsibility category. 
Because our factor displayed a cautionary 
reliability measure, as did Conger et al.'s, this 
particular ethical issue is a prime area for further 
exploration. 

Our privacy factor, while weak in its reliability 
score, validates that this issue remains of key 
concern just as Mason predicted many years 
ago. We know that as Internet use grows, 
privacy continues to be a hotly discussed and 
debated topic. This ethical issue would be a good 
candidate for further refinement as well, possibly 
discerning between various levels of risk 
associated with personal privacy. 
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The low reliability scores for the personal 
responsibility and privacy factors are cause for 
further review. Perhaps the scenarios comprising 
these two factors were less clear cut to some of 
the respondents. Moreover, issues such as use 
of pornographic material may be viewed 
differently by different cultures. Further data 
analysis is needed to compare factor structures 
among the different countries. 

Another possible explanation for the low 
reliability scores for the third and fourth factors 
is that perhaps there are really only a few 
dominant issues recognized by most students 
such as our varying levels of property misuse. 
Regardless of the reasons, it is clear that further 
refinement of the instrument is required. 

6. LIMITATIONS AND FUTURE RESEARCH 

As with any study, limitations must be 
acknowledged. In the current study, the use of 
students as survey respondents may have 
influenced the results. It is possible that even 
though participation was voluntary and 
anonymous, some students did not address the 
scenarios honestly or seriously. 

Additionally, perhaps the translation of the 
instrument into different languages caused 
different groups to interpret scenarios 
differently. Further breakdowns and comparisons 
among the countries will be analyzed. 

Another potential limitation is the research 
design. We chose to use ethical dilemma 
scenarios in order to build upon the work of 
other IS scholars. Perhaps a different approach 
would produce more enlightening results. For 
example, qualitative studies which include 
interviews with IT professionals might be 
warranted. 

The authors plan to continue work in identifying 
and classifying current ethical issues. The 
instrument used in this study can serve as a 
starting point for enhancement, modification and 
retesting, and other approaches will also be 
investigated. Other researchers are encouraged 
to also enhance upon this work. 

7. CONCLUSION 

The PAPA framework established an important 
basis for considering ethical issues in our field. 
This study identified a valid refinement of the 
issue of property misuse and thereby informs 
those teaching in the area of IT ethics. 

For educators, it remains clear that we have an 
obligation to teach our students how to be 
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responsible IT citizens, both in the workplace 
and in their personal lives. With each refinement 
of the ethical issue agenda, we can utilize the 
results to enhance and further expand our ethics 
related pedagogies. 

Our results also create implications for IT 
practitioners. It is important for IT professionals, 
especially managers, to understand that some 
employees might view computer related ethical 
issues based on their personal level of risk. For 
example, if no policy on personal email usage is 
in place, an employee might not see the harm in 
using company resources to send spam email for 
a good cause. It is important that organizations 
clearly define computing resource usage policies 
to prevent such actions. 
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Appendix 1. Four Factor PCA Results 


Scenario Item 

Factor 1 

Factor 2 

Factor 3 

Factor 4 

copy of spreadsheet 

.816 




word processing use 

.785 




copy of software 

.701 




shareware downloading 

.650 




music download 

.595 




company PC use 

.521 




password leaking 

.450 




unauthorized computer use 

.443 


.366 


making and selling 

.421 




off-shore gambling 

.398 




email employee 

.333 




trademark stealing 


.782 



patent leaking 


.751 



abuse authority 


.670 



patent violation 


.662 



shareware virus 


.530 



data manipulation 


.517 

.319 


error reporting 


.376 



access to payroll record 

.302 

.351 



email sending 



.768 


website creation 



.585 


virus spread 

.311 


.339 


firing porn site user 




.808 

email manager 



.310 

.531 

pornographic site user 


.359 


-.515 

email checking 


.436 

-.439 

.463 

database leaking 


.307 


.313 
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